fix: warn on ad hoc web-probe scripts

scripts/src/hwlab-node/web-observe-scripts.ts

@@ -558,6 +558,9 @@ export function runNodeWebProbeScript(
       degradedReason: recoveredReport.degradedReason,
       result: recoveredReport.result === null ? null : compactCommandResultRedacted(recoveredReport.result, [material.password ?? ""]),
     },
+    warnings: webProbeScriptGovernanceWarnings(options),
+    hints: webProbeScriptGovernanceHints(options),
+    preferredCommands: webProbeScriptPreferredCommands(options),
     recoveredArtifacts: recoveredArtifacts === null ? null : {
       source: recoveredArtifacts.source,
       degradedReason: recoveredArtifacts.degradedReason,
@@ -569,6 +572,34 @@ export function runNodeWebProbeScript(
   });
 }
 
+function webProbeScriptGovernanceWarnings(options: NodeWebProbeScriptOptions): Record<string, unknown>[] {
+  return [{
+    code: "web_probe_script_ad_hoc_only",
+    severity: "warning",
+    message: "web-probe script is for one-off exploration; repeated or high-frequency checks must be promoted to a typed command instead of rerunning temporary scripts.",
+    node: options.node,
+    lane: options.lane,
+    valuesRedacted: true,
+  }];
+}
+
+function webProbeScriptGovernanceHints(options: NodeWebProbeScriptOptions): string[] {
+  return [
+    "Prefer `web-probe observe start` plus `web-probe observe command` for interactive flows; use `observe collect/analyze` for repeated evidence reads.",
+    "If the same script is needed more than once, add or extend a reusable command type in the web-probe observe command surface.",
+    `For this target, start with: bun scripts/cli.ts web-probe observe start --node ${options.node} --lane ${options.lane} --target-path /projects/mdtodo`,
+  ];
+}
+
+function webProbeScriptPreferredCommands(options: NodeWebProbeScriptOptions): Record<string, string> {
+  return {
+    startObserver: `bun scripts/cli.ts web-probe observe start --node ${options.node} --lane ${options.lane} --target-path /projects/mdtodo`,
+    mdtodoSummary: "bun scripts/cli.ts web-probe observe collect <observerId> --view project-mdtodo-summary",
+    analyze: "bun scripts/cli.ts web-probe observe analyze <observerId>",
+    addCommandType: "Add a repo-owned web-probe observe command type before repeating this script.",
+  };
+}
+
 export function nodeWebProbeScriptRemoteShell(options: NodeWebProbeScriptOptions, secretSpec: RuntimeSecretSpec, password: string, webProbeProxy: NodeWebProbeHostProxyEnv): string {
   const userScriptB64 = Buffer.from(options.scriptText, "utf8").toString("base64");
   const runnerB64 = Buffer.from(nodeWebProbeScriptRunnerSource(), "utf8").toString("base64");